Sample viewer

vx.netlux.org/Virus.DOS.Dreg.1359

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:04:51.403123559Z 53 PC: 12a5f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:04:51.404805495Z 37 PC: 12a8e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:04:51.406074503Z 26 PC: 12ab7 | Set disk transfer address
2018-12-17T23:04:51.407132497Z 78 PC: 12aee | Find first file
2018-12-17T23:04:51.413620353Z 61 PC: 12b07 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:04:51.419968671Z 63 PC: 12b39 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:04:51.426149849Z 62 PC: 12b90 | Close file
2018-12-17T23:04:51.427885752Z 67 PC: 12bc3 | Get or set file attributes
2018-12-17T23:04:51.446337186Z 61 PC: 12bdc | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:04:51.452574173Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.455172869Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.458792449Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.460788251Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.462804049Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.46543929Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.467841675Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.470073772Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.472972453Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.475185124Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.477328381Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.48546867Z 44 PC: 12f24 | Get time 0x12f24: add dl, 0xd1
0x12f27: sub dl, 0xd1
0x12f2a: pop si
0x12f2b: push dx
0x12f2c: push si
0x12f2d: neg ax
0x12f2f: neg ax
0x12f31: ret
0x12f32: mov cx, 0x253
0x12f35: dec cx
0x12f36: inc cx
0x12f37: lea si, word ptr [bp + 0x10b]
0x12f3b: mov di, si
0x12f3d: or dx, 0
0x12f40: lodsw ax, word ptr [si]
0x12f41: or ch, 0
0x12f44: jmp 0x12f4f
0x12f46: xchg dl, dl
0x12f48: stosw word ptr es:[di], ax
0x12f49: loop 0x12f40
2018-12-17T23:04:51.487664793Z 66 PC: 1303b | Move file pointer
2018-12-17T23:04:51.488961346Z 64 PC: 1305c | Write file or device (Write 1359 bytes on handle 5)
2018-12-17T23:04:51.495128766Z 66 PC: 130ab | Move file pointer
2018-12-17T23:04:51.496619772Z 64 PC: 130bf | Write file or device (Write 4 bytes on handle 5)
2018-12-17T23:04:51.500971709Z 87 PC: 12d14 | Get or set file date and time
2018-12-17T23:04:51.502871953Z 62 PC: 12d18 | Close file
2018-12-17T23:04:51.511137286Z 67 PC: 12d4d | Get or set file attributes
2018-12-17T23:04:51.517301103Z 26 PC: 12da9 | Set disk transfer address
2018-12-17T23:04:51.518649181Z 37 PC: 12dcc | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')